Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #7801

Re: Digest Authentication

Show all headers | View raw

Am 14.12.2012 01:49, schrieb dhtmlkitchen@gmail.com:
> Hi,
> 
> I am trying to implement a password protected area of a site. I have never done this before.
> 
> HTTP digest authentication seemed suitable for our low-level security requirements.
> 
> Here is our PHP 5.3.6 configuration:
> http://thai-massage.com/phpinfo.php
> 
> Here is the script I am using, from PHP.net:
> http://php.net/manual/en/features.http-auth.php#example-349
> 
> The script is running here:
> http://thai-massage.com/dollar-school/PHP-PayPal-IPN-master/example/auth.php
> 
> The login credentials are hard coded for sake of example. Eventually I want to get the password from a MySQL database.

General answer:

I would never code basic auth or digest auth in PHP. This is a feature that is
offered completely functional by the web server. I would use it to lock up test
systems, or for the "quick and dirty" protection of some areas, used by few people
(only me).

The regular case is a real PHP login, using a database for user credentials, and
session variables to store the login status.

/Str.

Back to comp.lang.php | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Digest Authentication dhtmlkitchen@gmail.com - 2012-12-13 16:49 -0800
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 22:15 -0500
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 22:31 -0500
  Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-13 23:15 -0500
    Re: Digest Authentication xkit <dhtmlkitchen@gmail.com> - 2012-12-18 17:55 -0800
      Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-18 21:08 -0500
        Re: Digest Authentication dhtmlkitchen@gmail.com - 2012-12-19 09:40 -0800
          Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-19 15:02 -0500
            Re: Digest Authentication dhtmlkitchen@gmail.com - 2012-12-19 20:59 -0800
              Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 14:02 -0500
          Re: Digest Authentication "Peter H. Coffin" <hellsop@ninehells.com> - 2012-12-19 14:30 -0600
            Re: Digest Authentication "Twayne" <nobody@devnull.spamcop.net> - 2012-12-19 17:26 -0500
          Re: Digest Authentication Scott Johnson <noonehome@chalupasworld.com> - 2012-12-19 17:02 -0800
            Re: Digest Authentication "Twayne" <nobody@devnull.spamcop.net> - 2012-12-20 20:17 -0500
              Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 23:10 -0500
              Re: Digest Authentication The Natural Philosopher <tnp@invalid.invalid> - 2012-12-21 10:19 +0000
          Re: Digest Authentication "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-20 09:57 +0100
            Re: Digest Authentication Jerry Stuckle <jstucklex@attglobal.net> - 2012-12-20 14:06 -0500
    Re: Digest Authentication legalize+jeeves@mail.xmission.com (Richard) - 2012-12-22 19:15 +0000
  Re: Digest Authentication "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-12-14 12:05 +0100

csiph-web